1. GENERAL PROVISIONS.1.1. This Regulation on the processing of personal data (hereinafter –
The Regulation) was developed and applied by Infoexpert LLC (hereinafter
referred to as the Operator) in accordance with the Law of the Republic of Belarus dated 07.05.2021 No. 99-3 "On
Personal Data Protection"1.2. This Regulation defines the Operator's policy regarding
the processing of personal data accepted for processing, the procedure and conditions
for processing personal data of individuals who have transferred their
personal data for processing to the Operator (hereinafter referred to as personal
data subjects) with and without the use of automation tools,
establishes procedures aimed at preventing violations
of the legislation of the Republic of Belarus, elimination of the consequences of such violations
related to the processing of personal data.
1.3. The Regulation is designed to ensure the protection of the rights and freedoms
of personal data subjects when processing their personal data, as well
as to establish the responsibility of the Operator's officials who have access to
the personal data of personal data subjects for non-compliance with the requirements and
norms governing the processing of personal data.
1.4. This Provision does not apply to the relationship:
·arising from the processing of personal data of the Operator's employees,
since such relations are regulated by a separate local act;
·relationships that are not covered by the Law on Personal Data.
1.5. Personal data of the Subject of personal data is any
information relating directly or indirectly to a certain or identifiable
individual.
1.6. The term of processing of personal data is until the Subject withdraws
his consent to data processing or until the termination of the provision
of data storage services by the Operator.
1.7. The Operator processes the following personal data:
- Last name, First name, Patronymic;
- Email address;
- Phone number;
- Date of birth;
- Data of social network accounts;
- Information about the browser used;
- Location;
- IP address;
- Photos;
- Cookie data;
- Requested Internet pages;
- Product delivery addresses.
Upon receipt of personal data not specified in this paragraph, such
data shall be subject to immediate destruction by the person who unintentionally received them.
1.8. The Operator processes personal data
of Personal data Subjects for the following purposes:
·
registration
and (or) authorization of the Subject of personal data on the Operator
's website at:
https://www.karandash.by·
processing
orders of the Subject of personal data and fulfilling its obligations to him;
·
informing
The subject of personal data about promotions, special offers, new
products and services;·
for other purposes
, if the relevant actions of the Operator do not contradict the current
legislation, the Operator's activities, and the
consent of the Personal data Subject has been obtained for carrying out the specified processing;
1.9. The Operator processes the personal data of Site visitors
by performing any action (operation) or a set of actions
(operations) performed with or without
the use of automation tools, including the following:
·collection;
·recording;
·systematization;
·accumulation;
·storage;
·clarification (update, change);
·extraction;
·usage;
·transfer (distribution, provision, access);
·depersonalization;
·blocking;
·removal;
·destruction.
1.10. The fact that the Subject uses the personal data of the site www.karandash .
2.1. When processing personal data, the Operator is guided by the following
principles:
·legality and justice;
·timeliness and reliability of obtaining the consent of the personal data subject
to the processing of personal data;
·processing only personal data that meet the purposes of their processing;
·compliance of the content and volume of the processed personal data
with the stated purposes of processing.
The processed personal data should not be
redundant in relation to the stated purposes of their processing;·the inadmissibility of combining databases containing personal data,
the processing of which is carried out for purposes incompatible with each other;
· ensuring the accuracy of personal data, their sufficiency, and
, if necessary, relevance in relation to the purposes of personal
data processing.
The operator takes the necessary measures or ensures that they are taken to
delete or clarify incomplete or inaccurate data;·storing personal data in a form that allows you to identify the subject
of personal data for no longer than the purposes of personal
data processing require.
·ensuring the accuracy, sufficiency and relevance of personal data in
relation to the purposes of personal data processing;
·destruction or depersonalization of personal data in order to achieve the goals, their
processing or in case of loss of the need to achieve these goals.
2.2. The processing of personal data by the Operator is carried out in compliance with
the principles and rules provided for:
· The Law of the Republic of Belarus dated 07.05.2021 No. 99-3 "On Personal data protection"";
· This Regulation;
·Article 12 of the 1948 Universal Declaration of Human Rights
·Article 17 of the 1966 International Covenant on Civil and Political Rights;
·Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms
of 1950;
·The provisions of the Convention and the Commonwealth of Independent States on Human Rights and
Fundamental Freedoms (Minsk, 1995), ratified by the Russian Federation on 11.08. 1998
;
3. RECEIVING PERSONAL DATA.
3.1. Personal data of personal data subjects are obtained
Operator:·by personal transfer of personal data by the subject when entering data on
the website at:
https://www.karandash.by;·in other ways that do not contradict the legislation of the Republic of Belarus and the requirements
of international legislation on the protection of personal data.
3.2. The Operator receives and begins processing the Subject's personal data from
the moment of receiving his consent.
Consent to the processing of personal data may be given by the Subject
of personal data in any form that allows to confirm the fact of obtaining
consent, unless otherwise provided by law: in writing, orally or in any other
form provided for by applicable law, including through the performance
by the subject of personal data of conclusive actions.
3.3. Consent to the processing of personal data is considered granted
By the Subject of personal data through the commission by the Subject of personal
data of the following conclusive actions in the aggregate:-affixing in the appropriate form a mark of consent to the processing
of personal data in the amount, for the purposes and in the manner provided for in
the text proposed before registration for review.
The consent is considered received from the moment of such registration, subject to its
confirmation by the Subject of personal data in accordance with the established procedure and is valid
until the Subject of personal data sends a corresponding application
to terminate the processing of personal data at the location of the Operator.
In the absence of the consent of the Personal data Subject to the processing of his
personal data, such processing is not carried out.
3.4. The receipt of personal data by the Operator from other persons, as well as the transfer
of an order for the processing of personal data, is carried out on the basis
of an agreement containing conditions on the procedure for processing and maintaining
the confidentiality of the personal data received.
3.5. The subject of personal data may withdraw his
consent to the processing of personal data at any time, provided that such a procedure
does not violate the requirements of the legislation of the Republic of Belarus.
If the
Personal data Subject withdraws consent to the processing of personal data, the Operator has the right
to continue processing personal data without the consent of the Personal
data Subject only if there are grounds specified in the Law of the Republic of Belarus dated 07.05.2021 No. 99-3
"On the protection of personal data"3.6. Procedure for revoking consent to the processing of personal data:
- to revoke the consent to the processing of personal data given in
writing, it is necessary to submit a corresponding application in
writing at the location of the Operator;
- to revoke consent to the processing of personal data given in electronic
form, it is necessary in the personal account on the website www.karandash .
4. RULES AND PROCEDURE OF PROCESSING
PERSONAL DATA.4.1. Before the start of personal data processing, the Operator appoints
a person responsible for organizing the processing of personal data.
4.1.1. The person responsible for organizing the processing of personal data receives
instructions directly from the Operator's executive body and is accountable to it.
4.1.2. The person responsible for the organization of personal data processing has the right
to issue and sign a notification to the authorized body for the protection of the rights
of personal data subjects about the Operator's intention to process
personal data.
4.2. The processing of personal data is carried out by the Operator's employees
authorized to do so by the Regulations for managing access to personal data
of employees of LLC "Infoexpert", other internal documents of the Operator.
The Operator's employees who directly process personal
data must be familiarized before starting work:
·with the provisions of the legislation of the Republic of Belarus on personal data, including the
requirements for the procedure for the protection of personal data;
·with documents defining the Operator's policy regarding the processing
of personal data, including this Regulation, appendices and
amendments thereto;
·with local acts on the processing of personal data.
The training of employees is organized in accordance with
the schedules approved by the Operator.
The Operator's employees have the right to receive only those personal data
that they need to perform specific job duties.
The Operator's employees who process personal data must be
informed about the fact of such processing, about the features and rules of such
processing established by regulatory legal acts and internal documents
The operator.4.3. When processing personal data, the Operator applies legal,
organizational and technical measures to ensure the security of personal
data in accordance with the legislation of the Republic of Belarus.
4.4. Control over compliance by the Operator's employees with the requirements
of the legislation of the Republic of Belarus and the norms of international legislation, as well as the provisions
of local regulations of the Operator is organized by the Operator in accordance with this
Position.4.5. The Operator publishes or otherwise provides unrestricted access to
this Policy, other documents defining the Operator's policy
regarding the processing of personal data, and information about the requirements
for the protection of personal data implemented by the Operator by posting on
an electronic website owned by the Operator.
Access to personal data
The subjects are employees of the Operator who need personal data in
connection with the performance of their work duties. The list of employees who have
access to personal data is established by the local regulatory act of the Operator.Access to personal data of Subjects of employees not included in
the above list is carried out on the basis of an order
of the Operator's Executive Director prepared on the basis of a memo
from the head of the employee with a positive resolution responsible for organizing
the processing of personal data.
If the Operator entrusts the processing of personal data to third
parties who are not its employees on the basis of concluded contracts (or
other grounds), by virtue of which they must have access to the personal data
of the users of the Site, the corresponding data is provided by the Operator only
after signing with the persons processing personal data on
behalf of the Operator, a corresponding agreement, which should
define a list of actions (operations) with personal data that will
be performed by the person processing them and the purposes of processing,
the obligation of such a person to respect the confidentiality of personal
data and ensure the security of personal data during their processing must be established, and
the requirements for the protection of processed personal
data in accordance with the Law of the Republic of Belarus dated 07.05.2021 No. 99-3 "On the protection of personal
data" must also be specified. 5. STORAGE OF PERSONAL DATA.
5.1. The storage of personal data is carried out in accordance with
the written consent of the Personal data Subject or in accordance with
the consent expressed in an electronic form during the period established taking
into account the requirements of the current legislation of the Republic of Belarus.
If there are no
storage periods for certain types of personal data in the relevant regulatory legal acts, these personal data
are subject to storage for the period specified in the written consent
of the relevant Personal data Subject.
5.2. The storage of personal data is carried out no longer than
the purposes of personal data processing require.
The processed personal data
is subject to destruction or depersonalization upon achievement of the processing goals or in case
of loss of the need to achieve these goals (deletion
of the Personal Data Subject's account).5.3. The storage of personal data, the purposes of processing of which are different, should
be carried out separately within the information system or, subject to storage
on tangible media, within the structure of the affairs of the relevant
division of the Operator.
5.4. An employee of the Operator who has access to personal data in connection with
the performance of work duties ensures the storage of information containing
personal data of personal data subjects, excluding access to them
by third parties.
In the absence of an employee, there should be
no documents containing personal data at his workplace.
When going on vacation, business
trip and other cases of prolonged absence of an employee at the workplace,
he is obliged to transfer documents and other media containing personal data
to the person to whom the local act of the Operator will be entrusted with the performance of his
work duties. If such a person is not appointed, then documents and
other media containing personal data of Personal data
Subjects are transferred to another employee who has access to personal data of
Personal data Subjects at the direction of the head of the relevant structural
subdivision of the Operator.Upon dismissal of an employee who has access to personal data, documents
and other media containing personal data of Personal data
Subjects are transferred to another employee who has access to personal data of
Personal data Subjects at the direction of the head of the structural unit and with
notification of the person responsible for processing personal data.
6. CONTROL, RESPONSIBILITY FOR VIOLATION
OR NON-FULFILLMENT OF THE PROVISION.6.1. Control over the implementation of this Regulation is entrusted to the person responsible for
organizing the processing of personal data.
6.2. Persons who violate or fail to comply with the requirements of the Regulations are subject
to disciplinary, administrative or criminal liability.
6.3. The heads of the operator's structural divisions
are personally responsible for the performance of duties by their subordinates.
7. OTHER PROVISIONS.
7.1. This Regulation comes into force from the date of its approval by the sole
executive body of the Operator.
7.2. All employees of the Operator who are allowed to work with personal data
must be familiar with this Regulation before starting work with personal
data.
Consent to the processing of personal data
I am hereby informed that in accordance with the Law of the Republic of Belarus dated 07.05.2021 No. 99-3 "On
the protection of personal data", the information provided by me, including data on:
·
Last name, First name, Patronymic;·
Email address;·
Phone number;·
Date of birth;·
Data of social network accounts;·
Photo;·
Information about the browser used;·
Location;·
IP address;·
Cookie Data;·
Requested Web Pages;·
Product delivery address it will
be entered into the archive of the Personal data Processing Operator.
I grant
the right to process this data in order to organize the process of providing
the requested services, except in cases where it is expressly established otherwise. My
personal data will be used during my registration and/or authorization
on the site https://www.karandash .by for the purposes set out in clause 1.8. of the Regulations on
the processing of Personal Data.In connection with
the above purposes, my personal data may be disclosed to third
parties.
In the case of providing data to third parties, including contact details, I confirm that the Personal data Subject has been notified of the processing of his personal data by the Personal Data Processing Operator.
I am hereby informed that I have the right to request clarification of my personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate or not necessary for the stated purpose of processing, I can also request the termination of the processing of personal data at any time by sending a corresponding application to the address: Minsk, Independence Square, underpass No. 8, room No. 10 or withdraw your consent in your personal account on the website www.karandash.by I give my consent to the use of the provided personal data to send commercial information by the Personal Data Processing Operator and third parties to the specified phone number and email address.
I grant the right to send me information about the services, offers and promotions of the Operator and/or its Partners, including by electronic and mobile means of communication.
I am hereby informed that I can refuse to receive commercial information at any time by sending my application to the address: Minsk, Independence Square, underpass No. 8, room No. 10, or withdraw my consent in my personal account on the website www.karandash.by .